{
  "schema_version": "1.1",
  "id": "gdpr-breach-notification-72-hours",
  "slug": "gdpr-breach-notification-72-hours",
  "url": "https://groundedkit.com/claims/gdpr-breach-notification-72-hours/",
  "api_url": "https://groundedkit.com/api/claims/gdpr-breach-notification-72-hours.json",
  "claim": "Under GDPR, a controller must report a personal data breach to the regulator within 72 hours where feasible",
  "commonly_cited_as": "\"GDPR's 72-hour breach rule\"",
  "verdict": "verified",
  "verdict_definition": "Primary source found; it says the same thing, the scope matches, and it is reasonably current.",
  "confidence": "high",
  "rating": {
    "value": 5,
    "best": 5,
    "worst": 1
  },
  "origin": {
    "publisher": "European Union (GDPR Art. 33)",
    "title": "Regulation (EU) 2016/679, Article 33",
    "year": "2016 (applies since May 2018)"
  },
  "quote": "the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority",
  "method": "Text of the regulation (via gdpr-info.eu).",
  "drift": [
    "Not required if the breach is unlikely to result in a risk to people; late notices need reasons"
  ],
  "interest": "n/a (statutory or regulatory text).",
  "safe_rephrasing": "GDPR requires controllers to notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to pose a risk.",
  "sources": [
    {
      "title": "GDPR Art. 33 (gdpr-info.eu)",
      "url": "https://gdpr-info.eu/art-33-gdpr/",
      "primary": true
    }
  ],
  "kind": "reference_fact",
  "as_of": "In force",
  "last_checked": "2026-10-17",
  "stale": false,
  "date_reviewed": "2026-10-17",
  "license": "CC BY 4.0",
  "license_url": "https://creativecommons.org/licenses/by/4.0/"
}